- HIPAA limits what you can confirm, even when a patient has already told the world. Do not confirm that someone is a patient.
- Breach notices have clocks: individuals within 60 calendar days, with added notices to HHS and the media for larger breaches.
- Replying to a review is allowed. Naming care, diagnoses or even patient status is not.
- Healthcare PR specialists handle media and leadership. Online crisis firms handle search results, reviews and social posts.
- Your privacy officer and counsel approve every statement about an incident.
In this guide
Top pick for healthcare crisis management in 2026: Reputation Resolutions
Scored 93 out of 100 on our five-criteria methodology, the highest of any firm we rank for online crisis management. Results-based services for repairing, improving and protecting online reputations on Google and AI, and payment is only required after results are achieved. A+ BBB Accredited, in business since 2013.
What Crisis Communication in Healthcare Means
It is how a hospital or practice tells patients, staff, regulators and the public about an incident while protecting patient privacy.
Every industry has crises. Healthcare has a rule that most do not: patient privacy law shapes the answer. A retailer can reply to an angry customer with the order details. A hospital cannot reply to an angry patient with anything about their care.
That is why healthcare crisis communication starts with what you may not say. This guide is general information, not legal advice. Your privacy officer and counsel have the final word on any statement.
If your concern is a doctor's online reviews, see our list of the best reputation management for doctors. This guide covers the larger and more urgent cases.
What You Can and Cannot Say, by Incident Type
The safe pattern is simple: say what you are doing, never say anything that identifies or confirms a patient. These examples are starting points for your counsel to adapt.
| Incident | You can say | Do not say |
|---|---|---|
| A patient safety event reported in the news | We take patient safety seriously. We are reviewing the event and will share what we can. We have contacted the people involved | Anything about the person's condition, treatment, staff involved or whether they were a patient |
| A data breach | What type of information was involved, what happened in general terms, what you are doing and what people can do. Required notices go to affected individuals | Guesses about the cause, a count you have not confirmed or any blame on a vendor before facts are known |
| A viral patient review or post | Our door is open. We cannot discuss any person's care. Please contact us at this number | That the author was a patient, any detail of their visit or a rebuttal of their account |
| A staff misconduct allegation | We are aware and are investigating. The safety of patients and staff comes first | Names of staff, patients or details of personnel actions |
| A viral video filmed at your facility | We are aware of the video and are reviewing it. We protect the privacy of everyone in our care | Who is shown, why they were there or any account of their care |
| A news request about a named patient | We cannot comment on individual patients | Condition, location in the facility or status, even if the family has spoken |
Notice the pattern. Every can-say column speaks about the organization. Every do-not-say column speaks about a person. Keep that line clear and most mistakes disappear.
Financial institutions face a different rulebook, covered in crisis communications for financial institutions.
Ready to Fix What People See When They Search You?
Talk to a specialist at Reputation Resolutions, the top-scored firm on this list. You get a straight answer on what can be removed, what can be pushed down, and what it will take. Every service, from repairing to improving to protecting your reputation, is results-based and agreed in writing.
How a Hospital Should Respond to a Data Breach
Under the HHS breach notification rules, individuals must be told without unreasonable delay and no later than 60 calendar days after discovery. Larger breaches add notices to HHS and the media.
| Who must be told | When | Rule |
|---|---|---|
| Affected individuals | Without unreasonable delay and no later than 60 calendar days after the breach is discovered | 45 CFR 164.404 |
| Prominent media outlets, for a breach involving more than 500 residents of a State or jurisdiction | Without unreasonable delay and no later than 60 calendar days after discovery | 45 CFR 164.406 |
| The Secretary of HHS, for breaches of 500 or more individuals | At the same time as the individual notice | 45 CFR 164.408 |
| The Secretary of HHS, for breaches of fewer than 500 individuals | Log them, then report within 60 days after the end of the calendar year | 45 CFR 164.408 |
The individual notice must be in plain language. It must describe what happened, including dates if known, the type of information involved, what people can do to protect themselves, what you are doing to investigate and reduce harm, and how to reach you. Delivery is by first-class mail, or email if the person has agreed. If contact details are out of date for ten or more people, the rule calls for a website posting for 90 days or notice in major media, plus a toll-free number active for at least 90 days.
A law enforcement request can delay notice under 45 CFR 164.412. Your counsel decides when that applies. The HHS breach notification pages explain the process for reporting to the Secretary.
The rule says without unreasonable delay. A notice that goes out near the last day can still be late if the facts were known sooner.
For the wider say, repair and search sequence for a breach, see data breach and recall crisis communication.
Can a Hospital Respond to a Negative Review?
Yes, but carefully. HIPAA does not ban a reply. It bans using protected health information in it, and that has cost practices real money.
HHS has settled cases over just this. In June 2023 its Office for Civil Rights announced an agreement with a New Jersey psychiatry practice that disclosed patient information in response to negative Google reviews. The practice agreed to pay 30,000 dollars and follow a corrective action plan. In December 2022 it announced a settlement with a California dental practice over replies to Yelp reviews. Both are on HHS pages.
Do not confirm the person was a patient
Even a reply that says we are sorry about your visit confirms a relationship.
Write a generic reply
For example: we take feedback seriously and would like to hear from you. Please call this number. We cannot discuss any person's care.
Move the conversation offline
Give a phone number or email to a named person who can talk with the author directly.
Report what breaks platform rules
A review that is about no real visit, or contains private information, can be reported under the platform's written policy. Keep your evidence.
Ask your privacy officer to approve the template
Then your staff reuse one safe reply instead of writing a new one each time.
Do not ask patients for reviews in ways that break platform rules or hide negatives.
Hospitals comparing firms beyond crisis work can read the list of the best online reputation management companies.
Who Handles Hospital PR Crises: Two Kinds of Firm
Hospitals use healthcare PR specialists for media and leadership, and online crisis firms for what appears in search, reviews and social media. The two do not overlap much.
Healthcare PR specialists, often inside a hospital's communications team or an agency, manage reporters, spokespeople, staff messaging and community briefings. They are the right choice when the story is on the news.
Online crisis firms work after and alongside that. They look at what a patient or reporter will find when they search your name: viral reviews, reposted articles, social posts and AI answers. For the difference in depth, read crisis PR firms versus online crisis response.
Below are traditional crisis and strategic communications firms, listed alphabetically and unranked. They are general crisis firms, not healthcare specialists. Ask each directly whether it has worked with hospitals and with HIPAA.
Brunswick Group
Describes itself as a global advisory firm that helps organizations build relationships with their key stakeholders, including under high-pressure, high-stakes conditions (https://www.brunswickgroup.com).
brunswickgroup.comDezenhall Resources
Describes itself as a public affairs and crisis management firm, with a Washington, D.C. address listed (https://www.dezenhall.com).
dezenhall.comFTI Consulting Strategic Communications
FTI's Strategic Communications practice says it advises large organizations through complex moments of opportunity, change and geopolitical risk (https://www.fticonsulting.com/services/strategic-communications).
fticonsulting.com/services/strategic-communicationsJoele Frank, Wilkinson Brimmer Katcher
Describes itself as a strategic communications firm that helps clients in their most critical moments, with offices in New York and San Francisco (https://www.joelefrank.com).
joelefrank.comKekst CNC
Describes itself as a global strategic communications firm that helps protect and enhance client reputations, with Crisis and Issues Management listed as an expertise (https://www.kekstcnc.com).
kekstcnc.comSitrick and Company
Says it focuses on corporate, financial, transactional and crisis communications, with offices in Los Angeles, New York and Washington, D.C. (https://www.sitrick.com).
sitrick.comListed alphabetically, not ranked. Descriptions summarize each firm's own site, accessed November 9, 2026.
For the online part, see how firms score in the best crisis management firms for online crises. Online repair of old coverage is scored in the best online reputation repair companies.
Reputation Resolutions offers reputation management for healthcare practices and facilities. Its pitch: results-based services for repairing, improving and protecting online reputations on Google and AI. Payment is only required after results are achieved. It is A+ BBB Accredited, has been in business since 2013 and serves clients in 40+ countries. Removals typically take 30 to 60 days. No firm can confirm patient identity or discuss care on your behalf, and any outcome depends on the content and the platform's rules.
Patient Safety Incident Communications
After an incident, speak first to the people affected, then to staff, then to the public. Keep every public statement about the organization and what it is doing.
- Tell the affected patient and family directly, in person where possible, before any public statement
- Brief staff so they hear it from you and know who may speak
- Notify regulators and your insurer as your counsel advises
- Issue a short public statement about the organization, with no patient detail
- Open one phone line and one web page for questions
- Share what changed when the review is complete, within what privacy allows
After the event, the search results matter too. Publish accurate pages about your safety work and keep watching reviews and social posts for months. The method is in our guide to crisis communication best practices.
Past cases are compared in the guide to crisis management examples.
- 45 CFR 164.404, Notification to individuals, Legal Information Institute
- 45 CFR 164.406, Notification to the media, Legal Information Institute
- 45 CFR 164.408, Notification to the Secretary, Legal Information Institute
- HHS, Breach Notification Rule
- HHS press release, OCR reaches agreement with New Jersey provider over responses to negative online reviews, 2023-06-05
- HHS press release, OCR settlement with dental practice over disclosures of patients' PHI, 2022-12-14
- HHS, Manasa Health Center resolution agreement
Anthony Will
Founder and CEO, Reputation Resolutions
Anthony Will founded Reputation Resolutions, the publisher of this site, and has worked in online reputation management since 2013. He reviews the methodology and every scoring change.